FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
- Home
- FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems. The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done worse damage to the organization. For the incident responder, this process is known as ” threat hunting “. FOR508 teaches advanced skills to hunt, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivists.
Ways to Learn
Cybersecurity learning – at YOUR pace! OnDemand provides unlimited access to your training wherever, whenever. All labs, exercises, and live support from SANS subject matter experts included.
The full SANS experience live at home! Get the ultimate in virtual, interactive SANS courses with leading SANS instructors via live stream. Following class, plan to kick back and enjoy a keynote from the couch.
Did someone say ALL-ACCESS? On-site immersion via in-classroom course sessions led by world-class SANS instructors fill your day, while bonus receptions and workshops fill your evenings.
Instructor-led live online classes
FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
Instructor-led live online Training
Who Should Attend FOR508?
- Incident Response Team Members who regularly respond to complex security incidents/intrusions from APT groups/advanced adversaries and need to know how to detect, investigate, remediate, and recover from compromised systems across endpoints in the enterprise.
- Threat Hunters who are seeking to understand threats more fully and how to learn from them in order to more effectively hunt threats and counter their tradecraft.
- SOC Analysts looking to better understand alerts, build the skills necessary to triage events, and fully leverage advanced endpoint detection and response (EDR) capabilities.
- Experienced Digital Forensic Analysts who want to consolidate and expand their understanding of memory and timeline forensics, investigation of technically advanced individuals, incident response tactics, and advanced intrusion investigations.
- Detection Engineers requiring a better understanding of attacker tradecraft to build more effective intrusion detection mechanisms.
- Information Security Professionals who directly support and aid in responding to data breach incidents and intrusions.
- Federal Agents and Law Enforcement Professionals who want to master advanced intrusion investigations and incident response, and expand their investigative skills beyond traditional host-based digital forensics.
- Red Team Members, Penetration Testers, and Exploit Developers who want to learn how their opponents can identify their actions, how common mistakes can compromise operations on remote systems, and how to avoid those mistakes. This course covers remote system forensics and data collection techniques that can be easily integrated into post-exploit operating procedures and exploit-testing batteries.
- SANS FOR500 and SEC504 Graduates looking to take their skills to the next level.
NICE Framework Work Roles
- Cyber Defense Incident Responder (OPM 531)
- All Source-Collection Manager (OPM 311)
- All Source-Collection Requirements Manager (OPM 312)
- Cyber Operator (OPM 321)
- Cyber Crime Investigator (OPM 221)
- Law Enforcement /CounterIntelligence Forensics Analyst (OPM 211)
- Cyber Defense Forensics Analyst (OPM 212)
Training Features
Live Interactive Learning
- World-Class Instructors
- Expert-Led Mentoring Sessions
- Instant doubt clearing
Lifetime Access
- Course Access Never Expires
- Free Access to Future Updates
- Unlimited Access to Course Content
24x7 Support
- One-On-One Learning Assistance
- Help Desk Support
- Resolve Doubts in Real-time
Hands-On Project Based Learning
- Industry-Relevant Projects
- Course Demo Dataset & Files
- Quizzes & Assignments
Industry Recognized Certification
- CriveraTechnologies Training Certificate
- Graded Performance Certificate
- Certificate of Completion
Cloud
- Preconfigured Lab Environment
- Infrastructure with Tools and Software
- Single Sign-On
Course Curriculum
Overview
There are ways to gain an advantage against adversaries targeting you – it starts with the right mindset and knowing what works
The last decade has not been kind to network defenders. Threats to the modern enterprise are legion and attackers have used the enormous complexity of enterprise networks against us. But the tide is shifting. Over the past decade, we have seen a dramatic increase in sophisticated attacks against organizations. Nation-state attacks originating from the intelligence services of countries like China and Russia, often referred to as Advanced Persistent Threat (APT) actors, have proved difficult to suppress. Massive financial attacks from the four corners of the globe have resulted in billions of dollars in losses. Ransomware and extortion became an existential threat almost overnight. While the odds are stacked against us, the best security teams are proving that these threats can be managed and mitigated. FOR508 aims to bring those hard-won lessons into the classroom.
This course was designed to help organizations increase their capability to detect and respond to intrusion events. This is an achievable goal and begins by teaching the tools and techniques necessary to find evil in your network. This course is designed to make you and your organization an integral part of the solution. To keep pace, incident responders and threat hunters must be armed with the latest tools, analysis techniques, and enterprise methodologies to identify, track, and contain advanced adversaries with the ultimate goal of rapid remediation of incidents and damage mitigation. Further, incident response and threat hunting analysts must be able to scale their efforts across potentially thousands of systems in the enterprise. We start the day by examining the six-step incident response methodology as it applies to incident response for advanced threat groups. The importance of developing cyber threat intelligence to impact the adversaries’ “kill chain” is discussed and forensic live response techniques and tactics are demonstrated that can be applied both to single systems and across the entire enterprise.
Understanding attacks is critical to being able to detect and mitigate them. We start our education of attacker techniques on day one, learning common malware and attack characteristics and diving deep into techniques used by adversaries to maintain persistence in the network. Persistence is typically completed early in the attack cycle and students will learn hunting techniques to audit the network and accomplish early discovery. Living off the land binaries (local tools available in most environments), PowerShell, and WMI-based attacks in particular have become standard operating procedure for advanced adversaries and students get a lot of practice with tools and techniques to identify such attacks at scale. We end the day with an in-depth discussion of Microsoft credentialing. The complexity of credentials in the modern enterprise cannot be overstated and credentials are the number one vulnerability present in every network. By understanding the tools and techniques being used to target credentials, students learn how to prevent, detect, and mitigate these devastating attacks.
Exercises
- Forensic Lab Setup and Orientation Using the SIFT Workstation
- APT Incident Response Scenario Introduction
- Malware Persistence Detection and Analysis
- Creating Local and Remote Triage Evidentiary Images with KAPE
- Scaling Remote Endpoint Incident Response, Hunting, and Analysis Using Velociraptor
Topics
Real Incident Response Tactics
- Preparation: Key tools, techniques, and procedures that an incident response team needs to respond properly to intrusions
- Identification/Scoping: Proper scoping of an incident and detecting all compromised systems in the enterprise
- Containment/Intelligence Development: Restricting access, monitoring, and learning about the adversary in order to develop threat intelligence
- Eradication/Remediation: Determining and executing key steps that must be taken to help stop the current incident and the move to real-time remediation
- Recovery: Recording of the threat intelligence to be used in the event of a similar adversary returning to the enterprise
- Avoiding “Whack-A-Mole” Incident Response: Going beyond immediate eradication without proper incident scoping/containment
Threat Hunting
- Hunting versus Reactive Response
- Intelligence-Driven Incident Response
- Building a Continuous Incident Response/Threat Hunting Capability
- Forensic Analysis versus Threat Hunting Across Endpoints
- Threat Hunt Team Roles
- ATT&CK – MITRE’s Adversarial Tactics, Techniques, and Common Knowledge
Threat Hunting in the Enterprise
- Identification of Compromised Systems
- Finding Active and Dormant Malware
- Digitally Signed Malware
- Malware Characteristics
- Common Hiding and Persistence Mechanisms
- Finding Evil by Understanding Normal
Incident Response and Hunting Across the Enterprise
- Rapid Response Tooling Solutions
- PowerShell Remoting
- PowerShell Remoting Credential Safeguards
- Kansa PowerShell Remoting IR Framework
- KAPE Triage Collection Tool
- Velociraptor Incident Response Platform
Malware Defense Evasion and Identification
- Service Hijacking/Replacement
- Frequent Compilation
- Binary Padding
- Packing/Armoring
- Dormant Malware
- Signing Code with Valid Certificates
- Anti-Forensics/Timestomping
- Living of the Land Binaries and Security Tool Evasion
Malware Persistence Identification
- AutoStart Locations, RunKeys
- Service Creation/Replacement
- Service Failure Recovery
- Scheduled Tasks
- DLL Hijacking Attacks
- WMI Event Consumers
Prevention, Detection, and Mitigation of Credential Theft
- Pass the Hash
- Credential Attacks with Mimikatz
- Token Stealing
- Cached Credentials
- LSA Secrets
- Kerberos Attacks
- Golden Tickets
- Kerberoasting
- DCSync
- NTDS.DIT theft
- Bloodhound and Active Directory Graphing
- Common dumping tools including Metasploit, Acehash, Windows Credential Editor, and many others.
Overview
Even the most advanced adversaries leave footprints everywhere. Learn the secrets of the best hunters.
Cyber defenders have a wide variety of tools and artifacts available to identify, hunt, and track adversary activity in a network. Each attacker action leaves a corresponding artifact, and understanding what is left behind as footprints can be crucial to both red and blue team members. Attacks follow a predictable pattern, and we focus our detective efforts on immutable portions of that pattern. As an example, at some point an attacker will need to run code to accomplish their objectives. We can identify this activity via application execution artifacts. The attacker will also need one or more accounts to run code. Consequently, account auditing is a powerful means of identifying malicious. An attacker also needs a means to move throughout the network, so we look for artifacts left by the relatively small number of ways there are to accomplish internal lateral movement. In this section, we cover common attacker tradecraft and discuss the various data sources and forensic tools you can use to identify malicious activity in the enterprise.
Get ready to hunt!
Exercises
- Hunting and Detecting Evidence of Execution at Scale with Prefetch, Shimcache and Amcache
- Discovering Credential abuse with Event Log Collection and Analysis
- Tracking Lateral Movement with Event Log Analysis
- Hunting Malicious use of WMI and PowerShell
- Microsoft Defender Log Analysis
Topics
Advanced Evidence of Execution Detection
- Attacker Tactics, Techniques, and Procedures (TTPs) Observed Via Process Execution
- Prefetch Analysis
- Application Compatibility Cache (ShimCache)
- Amcache Registry Examination
- Scaling ShimCache and Amcache Investigations
Lateral Movement Adversary Tactics, Techniques, and Procedures (TTPs)
- Compromising Credentials Techniques
- Remote Desktop Services Misuse
- Windows Admin Share Abuse
- PsExec and Cobalt Strike Beacon PsExec Activity
- Windows Remote Management Tool Techniques
- PowerShell Remoting/WMIC Hacking
- Cobalt Strike Lateral Movement and Credential Use
- Vulnerability Exploitation
Log Analysis for Incident Responders and Hunters
- Profiling Account Usage and Logons
- Tracking and Hunting Lateral Movement
- Identifying Suspicious Services
- Detecting Rogue Application Installation
- Finding Malware Execution and Process Tracking
- Capturing Command Lines and Scripts
- Anti-Forensics and Event Log Clearing
Investigating WMI and PowerShell-Based Attacks
- WMI Overview
- WMI Attacks Across the Kill Chain
- Auditing the WMI Repository
- WMI File System and Registry Residue
- Command-Line Analysis and WMI Activity Logging
- PowerShell Transcript and ScriptBlock Logging
- Discovering Cobalt Strike beacon PowerShell Import Activity
- Detecting PowerShell Injection from Cobalt Strike, Metasploit, and Empire
- PowerShell Script Obfuscation
- Microsoft Defender Logs, Detection History, and MPLog Analysis
Overview
Using memory analysis sometimes feels like cheating – finding active attacks shouldn’t be this easy.
Memory forensics has come a long way in just a few years. It is now a critical component of many advanced tool suites (notably EDR) and the mainstay of successful incident response and threat hunting teams. Memory forensics can be extraordinarily effective at finding evidence of worms, rootkits, PowerShell attacks, ransomware precursors, and advanced malware used by targeted attackers. In fact, some fileless attacks may be nearly impossible to unravel without memory analysis. Memory analysis was traditionally the domain of Windows internals experts and reverse engineers, but new tools, techniques, and detection heuristics have greatly leveled the playing field making it accessible today to all investigators, incident responders, and threat hunters. Further, understanding attack patterns in memory is a core analyst skill applicable across a wide range of endpoint detection and response (EDR) products, making those tools even more effective. This extremely popular section will cover many of the most powerful memory analysis capabilities available and give analysts a solid foundation of advanced memory forensic skills to super-charge investigations, regardless of the toolset employed.
Exercises
- Detect unknown live and dormant custom malware in memory across multiple systems in an enterprise environment
- Examine Windows process trees to identify normal versus anomalies
- Find advanced “beacon” malware over common ports used by targeted attackers to access command and control (C2) channels
- Find residual attacker command-line activity through scanning strings in memory and by extracting command history buffer data
- Extract cached files from memory, including those opened from encrypted archives or removable media
- Leverage cached versions of the MFT and the Windows registry to perform traditional forensic analysis using only a memory image
- Compare compromised system memory against a baseline system using Frequency of Least Occurrence stacking techniques
- Identify advanced malware hiding techniques, including code injection and rootkits
- Understand Bring Your Own Vulnerable Driver (BYOVD) attacks and how to find them
- Employ indicators of compromise to automate analysis
- Analysis of memory from infected systems:
- Stuxnet
- TDL3/ TDSS
- CozyDuke APT29 RAT
- Rundll32 and Living Off the Land Executions
- Zeus/Zbot/Zloader
- Amadey
- Emotet
- SolarMarker/Jupyter
- Black Energy Rootkit
- WMI and PowerShell
- Cobalt Strike Beacons and Powerpick
- Cobalt Strike Sacrificial Processes
- Metasploit Meterpreter
- Custom APT command and control malware
Topics
- Endpoint Detection and Response (EDR)
- EDR Capabilities and Challenges
- EDR and Memory Forensics
- Memory Acquisition
- Acquisition of System Memory
- Hibernation and Pagefile Memory Extraction and Conversion
- Virtual Machine Memory Acquisition
- Memory changes in Windows 10 and 11
- Memory Forensics Analysis Process for Response and Hunting
- Understanding Common Windows Services and Processes
- Identify Rogue Processes
- Analyze Process Objects
- Review Network Artifacts
- Look for Evidence of Code Injection
- Audit Drivers and Rootkit Detection
- Dump Suspicious Processes and Drivers
- Memory Forensics Examinations
- Live Memory Forensics
- Memory Analysis with Volatility
- Webshell Detection Via Process Tree Analysis
- Code Injection, Malware, and Rootkit Hunting in Memory
- Advanced Memory Forensics with MemProcFS
- WMI and PowerShell Process Anomalies
- Extract Memory-Resident Adversary Command Lines
- Investigate Windows Services
- Hunting Malware Using Comparison Baseline Systems
- Find and Dump Cached Files from RAM
- Memory Analysis Tools
- Velociraptor
- Volatility
- MemProcFS
Overview
Timeline analysis will change the way you approach digital forensics, threat hunting, and incident response…forever.
Learn advanced incident response and hunting techniques uncovered via timeline analysis directly from the authors who pioneered timeline analysis tradecraft. Temporal data is located everywhere on a computer system. Filesystem modified/access/creation/change times, log files, network data, registry data, and browser history files all contain time data that can be correlated and analyzed to rapidly solve cases. Pioneered by Rob Lee as early as 2001, timeline analysis has grown to become a critical incident response, hunting, and forensics technique. New timeline analysis frameworks provide the means to conduct simultaneous examinations on a multitude of systems across a multitude of forensic artifacts. Analysis that once took days now takes minutes.
This section will step you through two primary methods of building and analyzing timelines used during advanced incident response, threat hunting, and forensic cases. Exercises will show analysts how to create timelines and how to introduce the key analysis methods necessary to help you use those timelines effectively in your cases.
Exercises
- Detecting malware defense evasion techniques
- Using timeline analysis, track adversary activity by hunting an APT group’s footprints of malware, lateral movement, and persistence
- Target hidden and time-stomped malware and utilities that advanced adversaries use to move in the network and maintain their presence
- Track advanced adversaries’ actions second-by-second through in-depth super-timeline analysis
- Observe how attackers laterally move to other systems in the enterprise by watching a trail left in filesystem times, registry, event logs, shimcache, and other temporal-based artifacts
- Identify root cause of an intrusion
- Learn how to filter system artifact, file system, and registry timelines to target the most important data sources efficiently
Topics
Malware Defense Evasion and Detection
- Indicators of Compromise – YARA
- Entropy and Packing Analysis
- Executable Anomaly Detection
- Digital Signature Analysis
Timeline Analysis Overview
- Timeline Benefits
- Prerequisite Knowledge
- Finding the Pivot Point
- Timeline Context Clues
- Timeline Analysis Process
Filesystem Timeline Creation and Analysis
- MACB Timestamps
- Windows Time Rules (File Copy versus File Move)
- Filesystem Timeline Creation Using Sleuthkit, fls and MFTECmd
- Bodyfile Analysis and Filtering Using the mactime Tool
Super Timeline Creation and Analysis
- Super Timeline Artifact Rules
- Program Execution, File Knowledge, File Opening, File Deletion
- Timeline Creation with log2timeline/Plaso
- log2timeline/ Plaso Components
- Filtering the Super Timeline Using psort
- Targeted Super Timeline Creation
- Super Timeline Analysis Techniques
- Scaling Super Timeline Analysis with Elastic Search (ELK)
Overview
Advanced adversaries are always improving. We must keep pace
Attackers commonly take steps to hide their presence on compromised systems. While some anti-forensics steps can be relatively easy to detect, others are much harder to deal with. As such, it’s important that forensic professionals and incident responders are knowledgeable on various aspects of the operating system and file system which can reveal critical residual evidence. Criminal and ransomware syndicates have become particularly aggressive in their use of anti-forensic techniques. In this section, we focus on recovering files, file fragments, and file metadata of interest to the investigation. These trace artifacts can help the analyst uncover deleted logs, attacker tools, malware configuration information, exfiltrated data, and more. This often results in a deeper understanding of the attacker TTPs and provides more threat intelligence for rapid scoping of an intrusion and mitigating damage. In some cases, these deep-dive techniques could be the only means for proving that an attacker was active on a system of interest and ultimately determining root cause. While very germane to intrusion cases, these techniques are applicable in nearly every forensic investigation.
Exercises
- Volume shadow snapshot analysis
- Timelines incorporating volume shadow snapshot data
- Anti-Forensics analysis using NTFS filesystem components
- Timestomp identification and suspicious file detection
- Advanced data recovery with records carving and deleted volume shadow copy recovery
Topics
Volume Shadow Copy Analysis
- Volume Shadow Copy Service
- Options for Accessing Historical Data in Volume Snapshots
- Accessing Shadow Copies with vshadowmount
- Volume Shadow Copy Timelining
Advanced NTFS Filesystem Tactics
- NTFS Filesystem Analysis
- Master File Table (MFT) Critical Areas
- NTFS System Files
- NTFS Metadata Attributes
- Rules of Windows Timestamps for $StdInfo and $Filename
- Detecting Timestamp Manipulation
- Resident versus Nonresident Files
- Alternate Data Streams
- NTFS Directory Attributes
- B-Tree Index Overview and Balancing
- Finding Wiped/Deleted Files using the $I30 indexes
- Filesystem Flight Recorders: $Logfile and $UsnJrnl
- Common Activity Patterns in the Journals
- Useful Filters and Searches in the Journals
- What Happens When Data Is Deleted from an NTFS Filesystem?
Advanced Evidence Recovery
- Markers of Common Wipers and Privacy Cleaners
- Deleted Registry Keys
- Detecting “Fileless” Malware in the Registry
- File Carving
- Volume Shadow Carving
- Carving for NTFS artifacts and Event Log Records
- Effective String Searching
- NTFS Configuration Changes to Combat Anti-Forensics
Overview
This incredibly rich and realistic enterprise intrusion exercise is based on a real-world advanced persistent threat (APT) group. It brings together techniques learned earlier in the course and tests your newly acquired skills in an investigation into an attack by an advanced adversary. The challenge brings it all together using a real intrusion into a complete Windows enterprise environment. You will be asked to uncover how the systems were compromised in the initial intrusion, find other compromised systems via adversary lateral movement, and identify intellectual property stolen via data exfiltration. Solving the final intrusion lab requires investigating artifacts on over thirty systems including Windows 10 and 11 workstations, DMZ servers, a domain controller, internal development servers, and hosted Exchange email. You will walk out of the course with hands-on experience investigating a real attack, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates to top-level ransomware groups.
Topics
- The Intrusion Forensic Challenge requires analysis of multiple systems from an enterprise network with many endpoints.
- Learn to identify and track attacker actions across an entire network finding initial exploitation, reconnaissance, persistence, credential dumping, lateral movement, elevation to domain administrator, and data theft/exfiltration
- Witness and participate in a team-based approach to incident response.
- Discover evidence of some of the most common and sophisticated attacks in the wild including Cobalt Strike, Sliver, Covenant, Remote Monitoring and Management (RMM) tools, PowerShell exploit frameworks, and custom nation-state malware.
- During the challenge, each incident responder will be asked to answer key questions and address critical issues in the different categories listed below, just as they would during a real breach in their organizations:
IDENTIFICATION AND SCOPING:
1. How and when was the network breached? Which system is “Patient Zero”?
2. How did the initial infection occur giving the attackers a foothold? What type of exploit was used?
3. When and how did the attackers first laterally move to each system?
4. What were the attacker’s primary and secondary command and control backdoors?
CONTAINMENT AND THREAT INTELLIGENCE GATHERING:
5. How and when did the attackers obtain domain administrator credentials?
6. What did the attackers look for on each system?
7. Damage Assessment: what data was stolen?
8. Damage Assessment: was email accessed or stolen?
9. Was any evidence of anti-forensics activity discovered?
10. Were the attackers able to access any cloud-based resources like cloud computing resources or cloud storage data?
11. Threat Intelligence: catalog host-based and network indicators of compromise.
REMEDIATION AND RECOVERY:
12. What level of account compromise occurred? Is a full password reset required during remediation?
13. Based on the attacker techniques and tools discovered during the incident, what are the recommended steps to remediate and recover from this incident?
a. What systems need to be rebuilt?
b. What IP addresses need to be blocked?
c. What countermeasures should we deploy to slow or stop these attackers if they come back?
d. What recommendations would you make to detect these intruders in our network again?
What You Will Learn?
Threat hunting and incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident or contain propagating ransomware. Incident response and threat hunting teams are the keys to identifying and observing malware indicators and patterns of activity in order to generate accurate threat intelligence that can be used to detect current and future intrusions. This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and ransomware operators.
- Understand attacker tradecraft to perform compromise assessments
- Detect how and when a breach occurred
- Quickly identify compromised and infected systems
- Perform damage assessments and determine what was read, stolen, or changed
- Contain and remediate incidents of all types
- Track adversaries and develop threat intelligence to scope a network
- Hunt down additional breaches using knowledge of adversary techniques
- Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects
The course exercises and final challenges illustrate real attacker traces found via end point artifacts, event logs, system memory, and more:
- Phase 1 – Patient zero compromise and malware C2 beacon installation
- Phase 2 – Privilege escalation, lateral movement to other systems, malware utilities download, installation of additional beacons, and obtaining domain admin credentials
- Phase 3 – Searching for intellectual property, network profiling, business email compromise, dumping enterprise hashes
- Phase 4 – Find exfiltration point, collect and stage data for theft
- Phase 5 – Exfiltrate files from staging server, perform cleanup and set long-term persistence mechanisms (alternatively this phase would be used to deploy ransomware)
- Understand attacker tradecraft to perform proactive compromise assessments
- Upgrade detection capabilities via better understanding of novel attack techniques, focus on critical attack paths, and knowledge of available forensic artifacts
- Develop threat intelligence to track targeted adversaries and prepare for future intrusion events
- Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects for use in both internal and external investigations
- Detect how and when attack happened
- Quickly identify compromised and infected systems
- Perform damage assessments and determine what was read, stolen, or changed
- Contain and remediate incidents
- Hunt down additional breaches using knowledge of the adversary
- Learn and master the tools, techniques, and procedures necessary to effectively hunt, detect, and contain a variety of adversaries and to remediate incidents.
- Detect and hunt unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment.
- Hunt through and perform incident response across hundreds of unique systems simultaneously using PowerShell, Velociraptor, and the SIFT Workstation.
- Identify and track malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connection residue.
- Determine how the breach occurred by identifying the root cause, the beachhead systems and initial attack mechanisms.
- Identify living off the land techniques, including malicious use of PowerShell and WMI.
- Target advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with living off the land techniques used to move in the network and maintain an attacker’s presence.
- Use memory analysis, incident response, and threat hunting tools in the SIFT Workstation to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more.
- Track user and attacker activity second-by-second on the system you are analyzing through in-depth timeline and super-timeline analysis.
- Recover data cleared using anti-forensics techniques via Volume Shadow Copy/Restore Point analysis.
- Identify lateral movement and pivots within your enterprise across your endpoints, showing how attackers transition from system to system without detection.
- Understand how the attacker can acquire legitimate credentials – including domain administrator rights – even in a locked-down environment.
- Track data movement as attackers collect critical data and shift it to exfiltration collection points.
- Recover data cleared using anti-forensics techniques via Volume Shadow Copy and Restore Point analysis and artifact carving.
- Use collected data to perform effective remediation across the entire enterprise.
- SIFT Workstation
- This course extensively uses the SIFT Workstation to teach incident responders and forensic analysts how to respond to and investigate sophisticated attacks.
- The SIFT Workstation contains hundreds of free and open-source tools, easily matching any modern forensic and incident response commercial response tool suite.
- A virtual machine is used with many of the hands-on class exercises.
- Ubuntu Linux LTS Base.
- 64-bit base system.
- Better memory utilization.
- Auto-DFIR package update and customizations.
- Latest forensics tools and techniques.
- VMware Appliance ready to tackle forensics
- Docker and ELK pre-installed
- Cross-compatibility between Linux and Windows.
- Expanded file system support (NTFS, HFS, EXFAT, and more).
- Electronic Download Package containing:
- Disk images, triage images, memory captures, logs, and timelines from an enterprise-wide intrusion
- SIFT Workstation virtual machines, tools, and documentation.
- SANS Intrusion Analysis Electronic Exercise Workbook
- An exercise workbook comprised of over 500 pages of detailed step-by-step instructions and examples to help you master incident response and threat hunting
- SANS DFIR Cheat Sheets to help use the tools in the field
- A multitude of bonus labs and practice data ensure students can continue working and learning long after the course is completed
Course Details
The GIAC Certified Forensic Analyst (GCFA) certification focuses on core skills required to collect and analyze data computer systems. Candidates have the knowledge, skills, and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats, anti-forensic techniques used by attackers, and complex digital forensic cases.
- Advanced Incident Response and Digital Forensics
- Memory Forensics, Timeline Analysis, and Anti-Forensics Detection
- Threat Hunting and APT Intrusion Incident Response
FOR508 is an advanced incident response and threat hunting course that focuses on detecting and responding to advanced persistent threats and organized crime threat groups. The course does not cover the basics of incident response policies or digital forensics.
We recommend that you should have a background in FOR500: Windows Forensics prior to attending this course.
Important! Bring your own system configured according to these instructions.
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.
Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.
MANDATORY FOR508 SYSTEM HARDWARE REQUIREMENTS
- CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
- CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
- BIOS settings must be set to enable virtualization technology, such as “Intel-VTx” or “AMD-V” extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
- 16GB of RAM or more is required.
- 350GB of free storage space or more is required.
- At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
- Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
MANDATORY FOR508 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS
- Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
- Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
- Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
- Local Administrator Access is required. (Yes, this is absolutely required. Don’t let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
- You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
- Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
- Download and install VMware Workstation Pro 17+ (for Windows hosts), or VMWare Fusion Pro 13+ (for macOS hosts) prior to class beginning. Workstation Pro and Fusion Pro are now available free for personal use from the VMware website. Licensed commercial subscriptions to these products can also be used.
- On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
- Download and install (for Windows Hosts) or (for macOS hosts). These tools are also included in your downloaded course materials.
Your course media is delivered via download. The initial media files for class can be large, with some files in the 30-40GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.
Your course materials include a “Setup Instructions” document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.
Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course’s labs.
If you have additional questions about the laptop specifications, please contact support.
“In describing the advanced persistent threat (APT) and advanced adversaries, many experts have said, ‘There are people smarter than you, who have more resources than you, and who are coming for you. Good luck with that.’ They were not joking. The results over the past several years clearly indicate that hackers employed by nation-states and organized crime are racking up success after success. The APT has compromised hundreds of organizations. Organized crime organizations using botnets are exploiting Automated Clearing House (ACH) fraud daily. Similar groups are penetrating banks and merchants, stealing credit card data. Fortune 500 companies are beginning to detail data breaches and hacks in their annual stockholder reports.
In other words, the enemy is getting better and bolder, and their success rate is impressive.
We can stop them, but to do so, we need to field more sophisticated incident responders and digital forensics investigators. We need lethal digital forensics experts who can detect and eradicate advanced threats immediately. A properly trained incident responder could be the only defense your organization has left during a compromise. Forensics 508: Advanced Digital Forensics, Incident Response, and Threat Hunting is crucial training for you to become the analyst who can step up to these advanced threats. The enemy is good. We are better. This course will help you become one of the best.”
“We live in a world of unimaginable amounts of data stored on immensely large and complicated networks. Our adversaries use this complexity against us to slice through our defenses and take virtually anything they want, anytime they want it. While this is our current state, it will not be our future. Incident response is at an inflection point. Old models are being upgraded to make defenders more effective and nimbler in response to more sophisticated and aggressive attackers. The most successful incident response teams are evolving rapidly due to near-daily interaction with adversaries. New tools and techniques are being developed, providing better visibility and making the network more defensible. There are an increasing number of success stories, with organizations quickly identifying intrusions and rapidly remediating them.
We created this course to build upon those successes. Like the field itself, the course is continuously updated, bringing the latest advances into the classroom. Whether you are just moving into the incident response field or are already leading hunt teams, FOR508 facilitates learning from others’ experiences and develops the necessary skills to take you to the next level.”